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Status of Claims 

1 . Claims 46-72 have been examined. 

Claim Objections 

2. Claims 48, 51-53, and 64 are objected to under 37 CFR 1 .75(c), as being 
of improper dependent form for failing to further limit the subject matter of a 
previous claim. Applicant is required to cancel the claim(s), or amend the 
claim(s) to place the claim(s) in proper dependent form, or rewrite the claim(s) in 
independent form. 

The step of sending a continuation message of independent claim 46 does 
not occur, if the call-up message is not valid (claims 48, 51-53 and 64). 

Claim Rejections - 35 USC § 101 

3. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

the claimed invention lacks patentable utility. 

Claims 46, 57-63 and 65-72 are abstract ideas. It has been held (lnAT& 

T Corp. v. Excel Communications Inc., 50 USPQ2d 1447) that even though, a 
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mathematical algorithm is not patentable in isolation, a process that applies a 
mathematical equation, formula or algorithm to a new and useful end qualifies as 
eligible subject matter outside the parameters of 101 . Claim 46 (and 48), for 
example, is dedicated to an algorithm for sending message, therefore, it is 
nothing more than an abstract ideas as it has not been reduced to some type of 
practical application (State Street Bank & Trust v. Signature Financial Group Inc., 
47 USPQ2d 1596). Sending a message, in the context of claim 46 (and 48), is 
not useful. A message, however, that conveys information or instruction, on the 
other hand, is. For example, the disputed claims of Alappat (In re Alappat, 31 
USPQ2d 1545) were dedicated to an apparatus that performs mathematical 
calculations for producing the useful, concrete, and tangible result of a rendering 
an image (i.e. smooth waveform display). In State Street, the subject matter was 
deemed patentable because the system took data representing discrete dollar 
amounts through a series of mathematical calculations for determining a final 
share price, while in AT&T v. Excel Communications, the subject matter was 
directed to generating a message record for an interexchange call between an 
originating subscriber and a terminating subscriber. Similarly, absent of providing 
a useful, concrete and tangible result, the mere storing or arranging of data in 
computer memory does not define patentable subject matter (claims 47, 49, 54, 
55, 59, and 67) 
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Claims 47-72 are also rejected as they depend from claim 46, and claims 
47-49, 54, 57-63 or 65-72. 



Claim Rejections - 35 USC §112 



4. The following is a quotation of the first paragraph of 35 U.S.C. 112: 

The specification shall contain a written description of the invention, and of the manner and process of 
making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the 
art to which it pertains, or with which it is most nearly connected, to make and use the same and shall 
set forth the best mode contemplated by the inventor of carrying out his invention. 

5. Claims 49, 50, 55 and 60-64 are rejected under 35 U.S.C. 112, first 
paragraph, as failing to comply with the enablement requirement. The claim(s) 
contains subject matter which was not described in the specification in such a 
way as to enable one skilled in the art to which it pertains, or with which it is most 
nearly connected, to make and/or use the invention. 

Claim 49 recites a guardian center storing call-up messages and 
continuation messages. However, the Specification details only "re-sending" a 
continuation message (Specification, page 42, lines 3-17). 

Claim 50 is also recited as it depends from claim 49. 

Claim 55 recites storing a continuation message in a tag table. However, 
the Specification only provides for using the continuation message to verify and 
update hash values (Specification, page 41 , lines 12-24; page 42, lines 10-17; 
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page 44, lines 13-17), and to verify a Guardian Center's signature (Specification, 
page 41, lines 19-24; page 44, lines 13-17; page 47, lines 28-29). 

Claim 60 is dedicated to call-up processing over a plurality of call-ups and 
a plurality of tag tables. Claim 64 is dedicated to multiple devices. The 
Specification does not support these processes. The Specification merely recites 
a user device having multiple tag tables (page 32, lines 20-22), call-ups 
regarding a single table (page 38/14-41/28; page 58/22-61/15), and a statement 
regarding how a feature of the Applicant's system prevents "attacks" that use 
different user devices (page 42, lines 18-28). 

Claim 67 recites "a hash function value of a portion of superfingerprints 
included in continuation messages". However, the Specification only provides 
support for Superfingerprints that include a list of hash values or a hash function 
of the sequence of all the currently and previously sent Superfingerprints 
(Specification, page 47, lines 4-12; page 49, lines 22-25; page/line 50/27-51/15). 

6. The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

7. Claims 48, 50-53, 60-64 and 72 are rejected under 35 U.S.C. 112, second 
paragraph, as being indefinite for failing to particularly point out and distinctly 
claim the subject matter which applicant regards as the invention. 



Application/Control Number: 09/706,074 
Art Unit: 3621 



Page 6 



a. Claim 46 recites "sending, by said guardian center, a digitally 
signed continuation message to said supervising program, said 
continuation message comprising a portion of said call-up message". 
However, this step is triggered by the previous step of the guardian center 
successfully verifying the call-up message. Claims 48 and 51-53 are 
directed to what happens when the call-up message is invalidated. 
Therefore, it is not obvious to one of ordinary skill what happens to the 
continuation message in this case. 

Claim 48 is also rejected because it recites "upon failure of said 
verification" and it is not clear to one of ordinary skill which "verification" 
step the claim is referring to. The verifying step of claim 46 or 47. 

Claim 50 recites sending a stored continued message. However, 
claim 49 from which claim 50 depends teaches storing the "received call- 
up message" of claim 46. Therefore, for claim 50 to be logical it has to 
occur prior to the sending of the call-up message of claim 46 or stored a 
priori by the guardian center. 

b. Claims 60-64 recites the limitation "storing... said hash function 
values of said tag tables" in lines 6-8 and "... computing said hash 
functions values of said tag tables..." in lines 10-11. There is insufficient 
antecedent basis for this limitation in the claim. 
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Claims 61-64 are also rejected as they depend from claim 60. 

Claim 61 is also rejected as it recites "user device descriptive 
values in said tag tables sent in said plurality of most recent call-ups". 
However, the user descriptive values are not part of a call-up message. 
One of ordinary skill, looking at claims 46 and 61 , is not provided with a 
time parameter for determining when the "storing of user device 
descriptive values" occurs in the context of hashing a tag table and 
sending a call-up message. 

Claims 62-64 are also rejected as they depend from claim 61. 

Claim 64 is also rejected as it recites "said tag tables sent in said 
plurality of most recent call-ups" in lines 4 and 5. There is insufficient 
antecedent basis for this limitation in the claim. 

Claim 67 recites the limitation "... a portion of superfingerprints 
included in continuation messages sent to said supervising program in 
previous call-ups". Call-ups are messages from a user device to a 
guardian center. Claim 67 also recites "said superfingerprints stored on 
the user device" in line 7. However, neither claims 67, nor 46 or 66 recite a 
user device storing a superfingerprint. 

Claim 68 recites the limitation "said user device time" in lines 1-2. 
There is insufficient antecedent basis for this limitation in the claim. 
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Claim 72 recites the limitation "that said total usage measured 
across all items..." in line 3. There is insufficient antecedent basis for this 
limitation in the claim. 

8. Claims 49, 50 and 67 are rejected under 35 U.S.C. 112, second 
paragraph, as being incomplete for omitting essential steps, such omission 
amounting to a gap between the steps. See MPEP § 2172.01. 

The omitted steps are: Call-up message can be completed. 
This is necessary as the method steps of claims 49 and 50 do not occur during 
normal processing described in claim 46 (Specification, page 40, lines 1-28; page 
41, lines 1-28; page 42, lines 3-8). 

In claim 67, the omitted steps are: including a time in the call-up message, 
verification on the part of the guardian center of the time in the call-up message 
(See Applicant's figure 13A). 

Claim Rejections - 35 USC § 103 

9. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for 
all obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 
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10. Claims 46-53, 55, 56, 65, and 68 rejected under 35 U.S.C. 103(a) as 

being unpatentable over Child et al., U.S. Patent No. 6,341 ,352 in view of Swift et 
al, U.S. Patent No. 5,719,941. 

As per claims 46-, Child et al. teach a method for controlling a user's 
access to online resources comprising: 

• a call-up message (figures 4 and 5) 

• sending a call-up message comprising a first tag table value, an identifier 
of said tag table and a second tag table value to a guardian center (figures 
4 and 5; column/line 6/29-7/65) 

• a center verifying that the second tag table value is associated with the 
identifier and is a most recently stored value in a list of tag table values, 
appending the first tag table value to the list upon verification and sends a 
continuation message to a user comprising a portion of said call-up 
message (figures 4 and 5; column/line 6/29-7/65) 

• sending a stored continuation message upon verification of a call-up 
message (figure 5) 

• sending a message indicating the failure of a second table value 
verification (figure 4) 

The method of Child et al. is implemented over the internet using a browser 
(figure 1; column 1, lines 12-32; column 4, lines 16-44), therefore, Child et al. 
teach verifying that a portion of a continuation message is equal to the 
corresponding portion sent in said call-up message and upon failure of said 
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verification performs a new "call-up" to said guardian center (i.e. caching). Child 
et al. do not teach digitally signing a communication between parties. However, 
the Examiner takes Official Notice that the use of digital signatures (e.g. 
superfingerprints) for authenticating communications is old and well known. The 
Examiner also takes Official Notice that the storing of correspondence or 
requests, as well as the time and date of said correspondence or request, 
regarding user personal information, between a user and a service provider is old 
and well-known to those of ordinary skill of customer service. Child et al. refer to 
the use of call-up messages to implement and/or reflect specific security policies 
(column 7, lines 35-40). Therefore, it would have been obvious to one of ordinary 
skill in computer security to require a user to provide verification during any event 
that is deemed "secure" such as the loading of software, utilization of computer 
resources, and accessing sensitive documents. Child et al. also do not explicitly 
recite the use of hashing. Swift et al. teach calculating hash function values and 
sending a call-up message comprising a first hash value, tag table identifier and 
a second hash value (column/line 7/48-8/47). In the performing of said 
calculations, Swift et al. introduce random values (e.g. a "salt") into said call-up 
messages (column 4, lines 13-21; column 10, lines 28-35). Swift et al. also teach 
comparing the second hash value against a list of stored hash values, and 
appending the first value to the list (figures 1-3; column 7, lines 9-28; column/line 
7/48-9/41 ). Swift et al. teach validating by a server a tag table [value] by 
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comparing it against specific policies (column 9, lines 28-41) that prevent a tag 
table [value] from being entered that does not conform with said policies. This 
policy also, necessarily, rejects future call-ups using said tag-table identifier. 
However, it has been held (In re Japiske, 181 F.2d 1019, 1023 86 USPQ 70, 73 
(CCPA 1950)) that it would have been obvious to one of ordinary skill to 
implement this function on the client end in order to save network resources by 
reducing the number of client-server exchanges. Therefore, it would have been 
obvious to one of ordinary skill to combine the teachings of Child et al. and Swift 
et al., because by storing tag table values as hashes an attacker who accesses 
the guardian centers list of values cannot readily access the tag table values 
from its corresponding hash value. 



1 1 . Claims 54, 57-59, 60-64, and 69-72 are rejected under 35 U.S.C. 103(a) 

as being unpatentable over Child et al., U.S. Patent No. 6,341,352 in view of 
Swift et al, U.S. Patent No. 5,719,941 as applied to claims 46 and 47 above and 
in further view of Kadooka, U.S. Patent No. 5,606,663. 

As per claims 54, Child et al. teach a method for supervising software 
usage comprising user call-up messages (figures 4 and 5). Similarly, Swift et al. 
teach supervising software usage comprising secured call-up messages (figures 
2-7). However, neither specifically recites replacing an old hash function value 
with a new hash function value on a user system. Kadooka teaches a user 
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system for updating tag-table values comprising replacing a new value with an 
old value in a table (figure 3). Kadooka also teaches controlling call-up messages 
by measuring time and total usage (abstract; figures 2 and 4b) and storing user 
device descriptive values in a tag table (figure 3). Further, as the Kadooka 
system is based on time measurement it would have been obvious to have the 
clocks of the various system components synchronized in order to have an 
operable system (figure 4b). Regarding claims 60 and 61, it has been held that 
duplicating a feature for a multiple effect would have been obvious to one of 
ordinary skill (In re Harza, 274 F.2d 669, 671, 124 USPQ 378, 380 (CCPA 
1960)). Claims 62 and 63 are directed to a searching a database. Child et al M 
Swift et al. and Kadooka a search of tag tables and/or tag table values. The 
values that are being searched for represent non-functional data, as what is 
being searched fordoes not affect system processing. Regarding claim 64, Swift 
et al. recite controlling the selection of tag table identifier values that do not 
comply with tag table value selection criteria by disabling said call-up messages 
that contain the offending value (column 9, lines 28-38). Hence, it would have 
been obvious to one of ordinary skill in secure call-up messaging to prevent the 
registration of tag table values by a guardian center that may result in the 
comprising of the system, for example, when said value is used by too many 
users. Therefore, it would have been obvious to one of ordinary skill to combine 
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the teachings of Child et al. ( Swift et al. and Kabooka in order to save network 
resources by reducing the number of client-server exchanges. 

Conclusion 

12. The prior art made of record and not relied upon is considered pertinent to 

applicant's disclosure: 

• Hyunh et al. teach password synchronization 

• Tock et al. teach a lockless-lookup hash table 

• Kausik teaches digital wallet with encryption 



1 3. Any inquiry concerning this communication or earlier communications from 

the Examiner should be directed to Calvin Loyd Hewitt II whose telephone 
number is (703) 308-8057. The Examiner can normally be reached on Monday- 
Friday from 8:30 AM-5:00 PM. 

If attempts to reach the Examiner by telephone are unsuccessful, the 
Examiner's supervisor, James P. Trammell, can be reached at (703) 305-9768. 
Any response to this action should be mailed to: 
Commissioner of Patents and Trademarks 
c/o Technology Center 2100 
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Washington, D.C. 20231 

or faxed to: 

(703) 305-7687 (for formal communications intended for entry and 
after-final communications), 

or: 

(703) 746-5532 (for informal or draft communications, please label 
"PROPOSED" or "DRAFT") 



Hand-delivered responses should be brought to Crystal Park 5, 
2451 Crystal Drive, 7th Floor Receptionist. 

Any inquiry of a general nature or relating to the status of this application 
should be directed to the Group receptionist whose telephone number is (703) 
308-1113. 



Calvin Loyd Hewitt II 
April 2, 2004 




